All In One WP Security < 4.4.11 - Authenticated Arbitrary Redirect / Reflected XSS

The plugin does not validate, sanitise and escape the redirectto parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redirect as well as Cross-Site Scripting issue. Exploitation of...

CVE-2020-29171

Cross-site scripting XSS vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall all-in-one-wp-security-and-firewall plugin before 4.4.6 for WordPress...

CVE-2020-29171

Cross-site scripting XSS vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall all-in-one-wp-security-and-firewall plugin before 4.4.6 for WordPress...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall all-in-one-wp-security-and-firewall plugin before 4.4.6 for WordPress...

CVE-2020-29171

Cross-site scripting XSS vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall all-in-one-wp-security-and-firewall plugin before 4.4.6 for WordPress...

CVE-2020-29171

Cross-site scripting XSS vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall all-in-one-wp-security-and-firewall plugin before 4.4.6 for WordPress...

CVE-2020-29171

CVE-2020-29171 is a Cross-site Scripting (XSS) vulnerability in the WordPress plugin Tips and Tricks HQ All In One WP Security & Firewall (all-in-one-wp-security-and-firewall) up to version 4.4.6. The flaw resides in admin/wp-security-blacklist-menu.php and stems from insufficient input validatio...

CVE-2020-29171: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall all-in-one-wp-security-and-firewall plugin before 4.4.6 for WordPress...

PT-2021-11654

Name of the Vulnerable Software and Affected Versions: all-in-one-wp-security-and-firewall plugin versions prior to 4.4.6 Description: The issue is a cross-site scripting XSS vulnerability in the admin/wp-security-blacklist-menu.php file of the Tips and Tricks HQ All In One WP Security & Firewall...

CVE-2020-36176

The CVE-2020-36176 affects the WordPress iThemes Security (formerly Better WP Security) plugin prior to version 7.7.0. The root issue is that the plugin does not enforce a new-password requirement for an existing account until the second login occurs, potentially leaving an account with a weak pa...

All In One WP Security & Firewall <= 4.4.1 - Open Redirect & Hidden Login Page Exposure

The All In One WP Security & Firewall plugin suffers from open redirect and exposure of the actual URL of the "hidden login page" feature. Edit WPScanTeam October 3rd, 2019 - Email sent to dev via https://wpsolutions-hq.com/contact/ October 8th - Dev ACK & investigating it October 8th - v4.4.2...

CVE-2015-9310: Improper Neutralization of Special Elements used in an SQL Command

The all-in-one-wp-security-and-firewall plugin before 3.9.1 for WordPress has multiple SQL injection issues...

PT-2019-7684

Name of the Vulnerable Software and Affected Versions all-in-one-wp-security-and-firewall plugin versions prior to 4.0.7 Description The issue is related to multiple SQL injection problems. Recommendations For versions prior to 4.0.7, update to version 4.0.7 or later to resolve the issue...

PT-2019-7683

Name of the Vulnerable Software and Affected Versions all-in-one-wp-security-and-firewall plugin versions prior to 4.0.9 Description The issue concerns SQL injection problems. Recommendations For versions prior to 4.0.9, update to version 4.0.9 or later to resolve the issue...

CVE-2016-10887: Improper Neutralization of Special Elements used in an SQL Command

The all-in-one-wp-security-and-firewall plugin before 4.0.9 for WordPress has multiple SQL injection issues...

CVE-2016-10888: Improper Neutralization of Special Elements used in an SQL Command

The all-in-one-wp-security-and-firewall plugin before 4.0.7 for WordPress has multiple SQL injection issues...

PT-2019-7269

Name of the Vulnerable Software and Affected Versions all-in-one-wp-security-and-firewall plugin versions prior to 3.9.1 Description The issue concerns multiple SQL injection problems. Recommendations For versions prior to 3.9.1, update to version 3.9.1 or later to resolve the issue...

PT-2019-7252

Name of the Vulnerable Software and Affected Versions all-in-one-wp-security-and-firewall plugin versions prior to 3.9.8 Description The issue concerns a Cross-Site Scripting XSS flaw in the unlock request feature of the plugin. This type of flaw allows attackers to inject malicious scripts into...

PT-2019-7253

Name of the Vulnerable Software and Affected Versions all-in-one-wp-security-and-firewall plugin versions prior to 3.9.5 Description The issue concerns a cross-site scripting XSS problem in the add query arg and remove query arg function instances. This could potentially allow attackers to inject...

CVE-2015-9294: Improper Neutralization of Input During Web Page Generation

The all-in-one-wp-security-and-firewall plugin before 3.9.5 for WordPress has XSS in addqueryarg and removequeryarg function instances...